Commit the working tree: graph incoming privacy fence, RapidMembership 10.4.1, integration oracles

Owner request: commit everything in the working tree. This is the
in-progress work of the parallel write-path session as it stood:
- GraphIncomingEdgesReader checks the target collection DocumentsRead grant
  before reading the collection definition and reports a denial as the same
  NotFound as a hidden vertex; GraphIncomingPrivacyTests covers the denial,
  the unchanged store and the healthy read after the grant is restored.
  CrossPartitionEdges.md describes the fence.
- ManagedCode.Orleans.RapidMembership 10.4.0 -> 10.4.1.
- Aspire integration oracles across authorization, client API, database
  composition, event streams, messaging, query execution and storage
  replication aligned with the current server contracts.
- Unit-test inventory updated for the new case.

Verification: not built or tested as a whole by this session, because a
dotnet test --no-build integration run was using the binaries; repository
governance passes. Build and Tests on this commit is the first full check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: KSemenenko

Directory.Packages.props

@@ -32,7 +32,7 @@
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.3.0" />
     <PackageVersion Include="ModelContextProtocol.Core" Version="2.3.0" />
     <PackageVersion Include="Microsoft.Orleans.Server" Version="10.4.0" />
-    <PackageVersion Include="ManagedCode.Orleans.RapidMembership" Version="10.4.0" />
+    <PackageVersion Include="ManagedCode.Orleans.RapidMembership" Version="10.4.1" />
     <PackageVersion Include="Microsoft.Orleans.Streaming" Version="10.4.0" />
     <PackageVersion Include="Microsoft.Orleans.Journaling" Version="10.4.0-alpha.1" />
     <PackageVersion Include="Microsoft.Orleans.DurableJobs" Version="10.4.0-alpha.1" />

docs/Features/GraphTraversal/CrossPartitionEdges.md

@@ -109,7 +109,7 @@ Frontend: N/A; no separate graph UI. SQL: N/A for this first edge transport stag
 
 Test-only extension of SAME GraphIncomingClusterTests.PersistedSourceGrantHidesCrossRowsAndTargetGraphDenialIsExplicit; original declaration/UID/Args/deadline/execution50/exclusiveheavy1 preserved. REQ/AC-AUTH-005/007, REQ/AC-GRAPH-XPART-003/005 and REQ-GRAPH-002 under ADR-014/102/125/117. Existing GraphIncomingClusterScenario explicitly verifies three distinct atomic partitions. No public/persisted/product/options/clock seam.
 
-Ordered flow: preserve original target-only source exclusion and target GraphRead denial. Retain full-reader original grants. Healthy admitted official MCP/SDK owner enters all four direct SDK/official MCP/Q1SDK/Q1MCP incoming routes through existing RequestCqrsClusterCallers and SqlClusterProtocol. Independent three-row literals retain all complete edges, full references, delivered revisions, redacted attributes and page version/projection; each call owns a fresh positive current cut. Persist epoch2 source database grant removal (local row only); epoch3 target DocumentsRead removal (PermissionDenied, no page); epoch4 original scoped repair (complete three rows); epoch5 Revoked (Unauthenticated, no protected page); epoch6 exact original scoped repair (complete three rows). All changes through existing authorized ConfigurePrincipal; full returned principal values compared, not caller role. Original MCP owner is created while healthy before revoke, then original requests reauthorize persisted state.
+Ordered flow: preserve original target-only source exclusion and target GraphRead denial. Retain full-reader original grants. Healthy admitted official MCP/SDK owner enters all four direct SDK/official MCP/Q1SDK/Q1MCP incoming routes through existing RequestCqrsClusterCallers and SqlClusterProtocol. Independent three-row literals retain all complete edges, full references, delivered revisions, redacted attributes and page version/projection; each call owns a fresh positive current cut. Persist epoch2 source database grant removal (local row only); epoch3 target DocumentsRead removal (NotFound, no page); epoch4 original scoped repair (complete three rows); epoch5 Revoked (Unauthenticated, no protected page); epoch6 exact original scoped repair (complete three rows). All changes through existing authorized ConfigurePrincipal; full returned principal values compared, not caller role. Original MCP owner is created while healthy before revoke, then original requests reauthorize persisted state.
 
 Each state operation brackets complete current administrator document images for ALL four vertices, all three partition outbox states and complete actual administrator incoming edge rows (cut observed independently, logical rows exact). All four refusal envelopes preserve errors and omit credentials/private marker; no global physical-position equality across replicated system commits or synthesized cut. Existing root administrator acts only as setup/current-state observer, never as substitute for reader admission.
 
@@ -123,4 +123,4 @@ Actual existing SqlModelViewClusterAuthorizationAssertions.AssertDeniedAsync est
 
 ## target collection privacy fence
 
-GraphIncomingEdgesReader.RequireVisible→TryRequireVisible catches target collection PermissionDenied as hidden visibility and returns exact NotFound. Epoch3 target DocumentsRead reduction requires NotFound/no page, independently from preserved original target GraphRead PermissionDenied. Source GraphRead absence omits remote rows. Original principals/policies and all public codes stay unchanged.
+GraphIncomingEdgesReader.RequireVisible→TryRequireVisible catches target collection PermissionDenied as hidden visibility and returns exact NotFound. Epoch3 target DocumentsRead reduction requires NotFound/no page, independently from preserved original target GraphRead PermissionDenied. Source GraphRead absence omits remote rows. Original principals/policies and all public codes stay unchanged. The reader checks the target collection DocumentsRead grant before it reads the collection definition and reports that denial as the same NotFound; `GraphIncomingPrivacyTests.TargetCollectionReadDenialIsNotFoundUntilTheGrantIsRepaired` covers the denial, the unchanged store and the healthy read after the grant is restored.

scripts/Features/CodeQuality/functional-coverage.unit-test-inventory.json

@@ -19997,9 +19997,9 @@
       "methodName": "HiddenSourceEndpointIsOmittedFromIncomingProjection",
       "instanceName": "HiddenSourceEndpointIsOmittedFromIncomingProjection",
       "sourcePath": "tests/KeyLoad.UnitTests/GraphTraversal/Cases/Graph/GraphIncoming/GraphIncomingPrivacyTests.cs",
-      "sourceSha256": "3b8d0538a2a3c21fa96178c0cbcba2eccf60cdbcc9e4c8a50d775009edb9fafe",
-      "lineNumber": 14,
-      "endLineNumber": 37,
+      "sourceSha256": "efcc8b9585aee902241a9fe762d1622e0f7497030659f5112e097c48c0ea0f98",
+      "lineNumber": 17,
+      "endLineNumber": 40,
       "classification": "functional",
       "exclusionReason": null,
       "requirements": [
@@ -20015,9 +20015,27 @@
       "methodName": "HiddenTargetEndpointIsNotFoundWithoutReturningProjectionRows",
       "instanceName": "HiddenTargetEndpointIsNotFoundWithoutReturningProjectionRows",
       "sourcePath": "tests/KeyLoad.UnitTests/GraphTraversal/Cases/Graph/GraphIncoming/GraphIncomingPrivacyTests.cs",
-      "sourceSha256": "3b8d0538a2a3c21fa96178c0cbcba2eccf60cdbcc9e4c8a50d775009edb9fafe",
-      "lineNumber": 39,
-      "endLineNumber": 61,
+      "sourceSha256": "efcc8b9585aee902241a9fe762d1622e0f7497030659f5112e097c48c0ea0f98",
+      "lineNumber": 42,
+      "endLineNumber": 64,
+      "classification": "functional",
+      "exclusionReason": null,
+      "requirements": [
+        "REQ-GRAPH-XPART-003"
+      ],
+      "acceptance": [
+        "AC-GRAPH-XPART-003"
+      ]
+    },
+    {
+      "className": "KeyLoad.UnitTests.GraphTraversal.GraphIncomingPrivacyTests",
+      "reportClassName": "KeyLoad.UnitTests.GraphTraversal.GraphIncomingPrivacyTests",
+      "methodName": "TargetCollectionReadDenialIsNotFoundUntilTheGrantIsRepaired",
+      "instanceName": "TargetCollectionReadDenialIsNotFoundUntilTheGrantIsRepaired",
+      "sourcePath": "tests/KeyLoad.UnitTests/GraphTraversal/Cases/Graph/GraphIncoming/GraphIncomingPrivacyTests.cs",
+      "sourceSha256": "efcc8b9585aee902241a9fe762d1622e0f7497030659f5112e097c48c0ea0f98",
+      "lineNumber": 66,
+      "endLineNumber": 96,
       "classification": "functional",
       "exclusionReason": null,
       "requirements": [
@@ -70133,6 +70151,7 @@
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingMcpContractTests|AndPublicJsonRoundTripsPreserveFullIncomingEdgeAndProjection|AndPublicJsonRoundTripsPreserveFullIncomingEdgeAndProjection",
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingPrivacyTests|HiddenSourceEndpointIsOmittedFromIncomingProjection|HiddenSourceEndpointIsOmittedFromIncomingProjection",
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingPrivacyTests|HiddenTargetEndpointIsNotFoundWithoutReturningProjectionRows|HiddenTargetEndpointIsNotFoundWithoutReturningProjectionRows",
+        "KeyLoad.UnitTests.GraphTraversal.GraphIncomingPrivacyTests|TargetCollectionReadDenialIsNotFoundUntilTheGrantIsRepaired|TargetCollectionReadDenialIsNotFoundUntilTheGrantIsRepaired",
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingProjectionTests|LocalCanonicalIncomingEdgeUsesZeroDeliveryRevision|LocalCanonicalIncomingEdgeUsesZeroDeliveryRevision",
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingProjectionTests|MixedLocalAndCrossRowsProjectProtectedFieldsBeforeRetention|MixedLocalAndCrossRowsProjectProtectedFieldsBeforeRetention",
         "KeyLoad.UnitTests.GraphTraversal.GraphIncomingSortCancellationTests|FullPageSortPreservesCancellationAndDeadlineAndHealthyReadFollows|FullPageSortPreservesCancellationAndDeadlineAndHealthyReadFollows",

src/KeyLoad.Core/GraphTraversal/Queries/GraphIncoming/GraphIncomingEdgesReader.cs

@@ -12,13 +12,14 @@ internal sealed class GraphIncomingEdgesReader(DatabaseEngine database, IKeyValu
 {
     private const string RangeExceeded = "The graph incoming-edge scan exceeds its bound.";
     private const string InvalidProjection = "A graph reverse projection is inconsistent.";
+    private const string VertexUnavailable = "The graph vertex is unavailable.";
     private ResourceDefinition targetGraph = null!;
     private ResourceDefinition targetCollection = null!;
 
     internal GraphIncomingEdgesPage Read()
     {
         targetGraph = RequireGraphRead(request.Target.Partition);
-        AuthorizationRequire(request.Target.Partition, Capability.DocumentsRead, request.Target.Collection);
+        RequireTargetCollectionRead();
         targetCollection = GraphIncomingReadScope.ReadCollection(view, grant,
             request.Target.Partition, request.Target.Collection, budget);
         request = request with
@@ -138,10 +139,20 @@ private ResourceDefinition RequireGraphRead(PartitionRef partition)
         }
     }
 
-    private void RequireVisible(EntityRef entity)
+    private void RequireTargetCollectionRead()
     {
-        const string VertexUnavailable = "The graph vertex is unavailable.";
+        try
+        {
+            AuthorizationRequire(request.Target.Partition, Capability.DocumentsRead, request.Target.Collection);
+        }
+        catch (KeyLoadException error) when (error.Code is ErrorCode.PermissionDenied)
+        {
+            throw Errors.Fail(ErrorCode.NotFound, VertexUnavailable);
+        }
+    }
 
+    private void RequireVisible(EntityRef entity)
+    {
         if (!TryRequireVisible(entity))
         {
             throw Errors.Fail(ErrorCode.NotFound, VertexUnavailable);

tests/KeyLoad.IntegrationTests/Authorization/Models/Eventing/EventingRequiredClaimClusterState.cs

@@ -5,6 +5,7 @@ internal sealed class EventingRequiredClaimClusterState(RequiredProcessingPolicy
     internal RequiredProcessingPolicyClusterState Input { get; } = input;
     internal ReceiveRequest Denied { get; } = new(Guid.NewGuid(), input.Lane);
     internal ReceiveRequest EpochProbe { get; } = new(Guid.NewGuid(), input.Lane, MaxBytes: 1);
+    internal ReceiveRequest Claim { get; } = new(Guid.NewGuid(), input.Lane);
     internal ReceiveResult EpochReceipt { get; set; } = null!;
     internal ReceiveResult Claimed { get; set; } = null!;
     internal bool Completed

tests/KeyLoad.IntegrationTests/Authorization/Observations/PolicyEpochMembership.cs

@@ -10,7 +10,7 @@ internal static class PolicyEpochMembership
     private const int MaximumResponseBytes = 16_384;
     private static readonly TimeSpan PollInterval = TimeSpan.FromMilliseconds(50);
 
-    internal static async Task WaitForSurvivorAsync(ClusterFixture fixture, CancellationToken token)
+    internal static async Task WaitForSurvivorsAsync(ClusterFixture fixture, string[] survivors, CancellationToken token)
     {
         using var http = McpCallerHttp.Create(fixture, McpCallerProtocol.Node2);
         http.MaxResponseContentBufferSize = MaximumResponseBytes;
@@ -24,7 +24,7 @@ internal static async Task WaitForSurvivorAsync(ClusterFixture fixture, Cancella
                 ?? throw new InvalidDataException("The Orleans membership health response is missing.");
             await File.WriteAllTextAsync(Path.Combine(TestContext.ResultsDirectory, "policy-authority-membership.json"),
                 JsonSerializer.Serialize(snapshot, JsonDefaults.Options), token);
-            if (snapshot.ActiveSilos.SequenceEqual(new[] { McpCallerProtocol.Node2 }, StringComparer.Ordinal))
+            if (snapshot.ActiveSilos.Order(StringComparer.Ordinal).SequenceEqual(survivors, StringComparer.Ordinal))
             {
                 return;
             }

tests/KeyLoad.IntegrationTests/Authorization/Scenarios/Eventing/EventingRequiredClaimClusterFinal.cs

@@ -16,7 +16,9 @@ await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, sta
             await EventingRequiredClaimClusterCurrent.ObserveAsync(root, state, async () => await SqlClusterProtocol.EqualAsync(
                 state.Receipt, await RequiredProcessingPolicyClusterRoutes.ProcessAsync(reader, state.Input, state.Healthy, route, token)), token);
         }
-        await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Denied,
+        await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Denied, ErrorCode.PermissionDenied,
+            RequiredProcessingPolicyClusterState.EpochChanged, token);
+        await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Claim,
             ErrorCode.StaleLease, "The delivery lease is stale.", token);
         await EventingRequiredClaimClusterTenant.RefuseAsync(root, reader, state, token);
         await EventingRequiredClaimClusterExport.RefuseAsync(root, reader, state, token);

tests/KeyLoad.IntegrationTests/Authorization/Scenarios/Eventing/EventingRequiredClaimClusterWarm.cs

@@ -15,13 +15,15 @@ internal static async Task RunAsync(RequestCqrsClusterCallers root, RequestCqrsC
         await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.EpochProbe, ErrorCode.PermissionDenied, RequiredProcessingPolicyClusterState.Denied, token);
         await RequiredProcessingPolicyClusterSetup.PolicyAsync(root, input, RequiredProcessingPolicyClusterState.Before, token);
         await EventingRequiredClaimClusterReceive.ReplayAsync(root, reader, state, state.EpochProbe, state.EpochReceipt, token);
+        await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Denied, ErrorCode.PermissionDenied, RequiredProcessingPolicyClusterState.Denied, token);
         await RequiredProcessingPolicyClusterSetup.PrincipalAsync(root, input, 2L, true, token);
         await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Denied, ErrorCode.Unauthenticated, "The credential is unavailable or expired.", token);
         await RequiredProcessingPolicyClusterSetup.PrincipalAsync(root, input, 3L, false, token);
         await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.EpochProbe, ErrorCode.PermissionDenied, RequiredProcessingPolicyClusterState.EpochChanged, token);
-        state.Claimed = await RequiredProcessingPolicyClusterRoutes.ReceiveAsync(reader, input, "first", state.Denied, token);
+        await EventingRequiredClaimClusterRefusals.ReceiveAsync(root, reader, state, state.Denied, ErrorCode.PermissionDenied, RequiredProcessingPolicyClusterState.EpochChanged, token);
+        state.Claimed = await RequiredProcessingPolicyClusterRoutes.ReceiveAsync(reader, input, "first", state.Claim, token);
         var delivery = state.Claimed.Deliveries.Single();
-        await EventingRequiredClaimClusterReceive.ReplayAsync(root, reader, state, state.Denied, state.Claimed, token);
+        await EventingRequiredClaimClusterReceive.ReplayAsync(root, reader, state, state.Claim, state.Claimed, token);
         var forged = input.Processing(delivery, "first") with
         {
             Token = delivery.Token + ".forged"

tests/KeyLoad.IntegrationTests/Authorization/Scenarios/PolicyEpochs/PolicyEpochAuthorityOutage.cs

@@ -10,7 +10,10 @@ namespace KeyLoad.IntegrationTests.Authorization;
 internal static class PolicyEpochAuthorityOutage
 {
     private const string Scenario = "policy-cursor-authority-unavailable";
-    private static readonly string[] StoppedNodes = [McpCallerProtocol.Node1, McpCallerProtocol.Node3];
+    // One copy is lost while the membership majority survives: losing a majority stops membership agreement until the
+    // whole cluster restarts, so it cannot model a recoverable authority outage.
+    private static readonly string[] StoppedNodes = [McpCallerProtocol.Node3];
+    private static readonly string[] Survivors = [McpCallerProtocol.Node1, McpCallerProtocol.Node2];
 
     internal static async Task RunAsync(ClusterFixture fixture, RequestCqrsClusterCallers reader,
         KeyLoadClient root, PolicyEpochPublicState state, CancellationToken token)
@@ -27,7 +30,7 @@ await ServerFailureObserver.ObserveAsync(async () =>
                 stopped.Add(node);
                 await fixture.KillServerAsync(node, Scenario, token);
             }
-            await PolicyEpochMembership.WaitForSurvivorAsync(fixture, token);
+            await PolicyEpochMembership.WaitForSurvivorsAsync(fixture, Survivors, token);
             await ReadAvailableAsync(reader, state, cursors, token);
             await ClusterReplicationTestSupport.MissingCopiesAsync(await root.CommitAsync(state.Seed, token));
             var available = await PolicyEpochPublicAssertions.ImageAsync(root, state.Scenario, token);

tests/KeyLoad.IntegrationTests/ClientApi/Assertions/Mcp/McpCatalogExpectations.cs

@@ -118,7 +118,7 @@ internal static ImmutableArray<McpToolExpectation> Entries
         new(QueueDispatchName, false, true, true, McpExpectedBody.Object, true,
             ["tenantId", "databaseId", "queue", "expectedSchemaVersion", "paused"],
             ["name", "kind", "transactionDomainId", "indexes", "fieldPolicies", "headerPolicies",
-                "queuePolicy", "eventRetention", "authority", "schemaVersion", "paused", "blobPolicy",
+                "queuePolicy", "eventRetention", "authority", "schemaVersion", "paused", "filePolicy",
                 "relationalSchema", "vectorProfiles", "inboxPolicy", "analyticsSchema"],
             BodyPropertyFields: ["tenantId", "databaseId", "queue", "expectedSchemaVersion", "paused"]),
         new(McpCallerTools.ResourcesConfigure, false, true, false, McpExpectedBody.Object, true,